CVE-2023-40931

MEDIUM 6.5CVE-2023-40931 · Published 19/09/2023 · updated 09/07/2026

Package	Affected versions	Patched versions
nagios xi nagios	`≥ 5.11.0, < 5.11.2`	`5.11.2`

Description

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

References

outpost24.com/blog/nagios-xi-vulnerabilities · Third Party Advisory
nagios.com/products/security · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free